Bug 1981435 (CVE-2021-22922)

Summary:	CVE-2021-22922 curl: Content not matching hash in Metalink is not being discarded
Product:	[Other] Security Response	Reporter:	Marian Rehak <mrehak>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	amctagga, andrew.slice, anharris, bdettelb, bniver, bodavis, caswilli, csutherl, dbhole, fcanogab, fjansen, flucifre, gkamathe, gmeno, gzaronik, hhorak, hvyas, jclere, jnakfour, jorton, jwon, kanderso, kaycoth, kdudka, krathod, luhliari, lvaleeva, mbenjamin, mhackett, msekleta, mthacker, mturk, omajid, paul, pjindal, psegedy, rwagner, security-response-team, sostapov, svashisht, szappis, tomckay, vereddy, vmugicag
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	curl 7.78.0	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in curl in the way curl handles a file hash mismatch after downloading content using the Metalink feature. This flaw allows malicious actors controlling a hosting server to trick users into downloading malicious content. The highest threat from this vulnerability is to integrity.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-09-21 18:21:07 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1982093, 1982094, 1983576, 1983577, 1983578, 1983579, 1983580, 1984325, 2000672
Bug Blocks:	1981436

Description Marian Rehak 2021-07-12 14:30:33 UTC

When curl is instructed to download content using the metalink feature, the contents is verified against a hash provided in the metalink XML file. There's a risk the user doesn't notice the message and instead assumes the file is fine.

Comment 1 Marian Rehak 2021-07-12 14:35:11 UTC

This flaw has existed in curl since commit [b5fdbe848bc3d](https://github.com/curl/curl/commit/b5fdbe848bc3d) in curl 7.27.0, released on July 27, 2012.

Comment 8 Marian Rehak 2021-07-21 09:11:54 UTC

Created curl tracking bugs for this issue:

Affects: fedora-all [bug 1984325]

Comment 14 Tomas Hoger 2021-08-25 14:17:08 UTC

Upstream advisory:


https://curl.se/docs/CVE-2021-22922.html

Comment 21 errata-xmlrpc 2021-09-21 08:40:38 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:3582 https://access.redhat.com/errata/RHSA-2021:3582

Comment 22 Product Security DevOps Team 2021-09-21 18:21:07 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-22922

Comment 24 errata-xmlrpc 2021-10-19 07:02:33 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:3903 https://access.redhat.com/errata/RHSA-2021:3903